Create incident manually, from an integration feed, or by adding Unit 42 data.
Indicators can be created manually, from an integration feed, or by adding Unit 42 data.
Create an indicator manually.
Add the Basic information.
In the Verdict section you can either select a verdict or Calculate the verdict if the indicator exists in the Cortex XSOAR database.
Add any custom indicator fields.
Save the indicator.
Fetch indicators from Feed Integrations.
(TIM only) Add Unit 42 Intel Data to Cortex XSOAR.